CVE-2026-92528: 
GitLab vulnerability analysis and mitigation

CVE-2026-92528 is an incorrect authorization vulnerability in GitLab Enterprise Edition (EE) that allows an authenticated user to approve a merge request despite having contributed commits to it, due to improper identity resolution. It affects GitLab EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The vulnerability was published on October 13, 2026, and GitLab has released patches for all affected version branches. It carries a CVSS v3.1 base score of 4.2 (Medium) (GitHub Advisory, GitLab Patch Release).

The root cause is classified as CWE-863 (Incorrect Authorization), stemming from improper identity resolution within GitLab EE's merge request approval workflow. Under certain conditions, the platform fails to correctly correlate a user's identity as a commit contributor with their identity as an approver, allowing the authorization check that prevents self-approval to be bypassed. Exploitation requires network access, low privileges (an authenticated account), and high attack complexity, meaning specific conditions must be met for the bypass to succeed. No public proof-of-concept or detailed technical write-up has been published as of the disclosure date (GitHub Advisory, GitLab Issue).

Successful exploitation allows an authenticated GitLab EE contributor to approve merge requests containing their own commits, circumventing code review controls designed to enforce separation of duties. This undermines the integrity of the software development lifecycle by enabling unauthorized or malicious code changes to be merged without independent peer review. The confidentiality impact is low (limited information exposure), the integrity impact is low to moderate (unauthorized code merges), and there is no availability impact (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement further limits opportunistic exploitation (GitHub Advisory).

GitLab has released patched versions addressing this vulnerability: upgrade to 19.2.8 (for instances running 16.11–19.2.x), 19.3.5 (for 19.3.x), or 19.4.2 (for 19.4.x). Until patching is complete, administrators should consider requiring multiple independent reviewers for merge request approvals and auditing recent merge request approvals where the approver also contributed commits. Disabling self-approval at the group or project level via GitLab configuration settings can serve as an interim control (GitLab Patch Release, GitHub Advisory).